>I increasingly encounter outright blocks rather than any sort of captcha when visiting cloudflare "protected" sites.

???

Unless you're browsing around with the googlebot user agent string, you should be getting turnstile challanges at most, not blocks. And if you're getting a turnstile challenge it's unclear how it's different than an anubis challenge. If you're outright blocked, it's probably a site decision (eg. block all VPNs or block everyone not from a given country) rather than cloudflare's.

▲

amatecha 3 hours ago | parent | next [-]

Try using Firefox with "resist fingerprinting" enabled, on OpenBSD, if you want an idea of how insidious Cloudflare's increasing prevalence is for the openness of the web. Inexplicable 403 responses for entire domains for no apparent reason, no "captcha", just blocked outright. Heck, it happens on Linux too, and even without "resist fingerprinting" enabled.

	▲	ipaddr 2 hours ago \| parent [-]
		Happens with older chrome browsers as well. Last supported windows 7 version. Started this month.

▲

gucci-on-fleek 3 hours ago | parent | prev | next [-]

> And if you're getting a turnstile challenge it's unclear how it's different than an anubis challenge.

You are guaranteed to pass an Anubis challenge eventually [0], whereas it's possible to get stuck forever in an infinitely-looping Turnstile challenge.

> If you're outright blocked, it's probably a site decision (eg. block all VPNs or block everyone not from a given country) rather than cloudflare's.

Cloudflare blocks legitimate users itself sometimes [1].

[0]: Unless you run into a bug, but Anubis is open source, so you can always submit a patch upstream. I've done this myself, and I can confirm that it's relatively straightforward.

[1]: https://news.ycombinator.com/item?id=43329320

▲

gruez 3 hours ago | parent [-]

>You are guaranteed to pass an Anubis challenge eventually [0]

That's a double edged sword because bots will eventually get through too, and unlike humans, their time is dirt cheap.

>Cloudflare blocks legitimate users itself sometimes [1].

I never ran into this issue despite using seemingly maximally suspicious configs like tor browser. I can't say the same for some other vendors.

▲

gucci-on-fleek 2 hours ago | parent [-]

> That's a double edged sword because bots will eventually get through too, and unlike humans, their time is dirt cheap.

Yeah, I really have no idea why Anubis works right now: residential proxies are far more expensive than compute, yet the bots seem to have no problem obtaining millions of residential IPs, but they give up on even short-ish Anubis challenges.

> I never ran into this issue despite using seemingly maximally suspicious configs like tor browser. I can't say the same for some other vendors.

Yeah, I don't like the Cloudflare challenges, but in the past 5 years I've only had it outright block me once, and that fixed itself after 15 minutes. And I use Firefox on Linux with various privacy extensions, so my browser probably appears at least moderately suspicious.

Whereas I've been trapped in impossible ReCaptcha loops quite a few times, which is still better than vague error messages that magically go away when I switch to something not running Linux. So I'll begrudgingly accept that Turnstile is the least user-hostile product on the market right now.

	▲	raincole an hour ago \| parent [-]
		The only reason Anubis works right now is that it's not very commonly used and the bots are not optimized to bypass it (yet).

▲

m00dy 19 minutes ago | parent | prev [-]

yeah, googlebot user agent thing was a thing maybe around 10 years ago but I don't think it's working today. Maybe if you start the http session from gcloud, it might still work.